Cisco IR1821/IR1101

Pre-requisites

Switch Model	Cisco Catalyst IR1821 (for example, IR1821-K9) Cisco Catalyst IR1101 (for example, IR1101-K9)
Firmware requirements	Firmware version >= 17.x. The firmware versions tested in this guide are: IR1821: 17.16.1a IR1101: 17.9.3 Note: Cisco uses IoX platform to support the Docker app. Ensure that you are using an actively supported IOS version (17.x or higher) to maintain compatibility with IoX. Using unsupported versions may restrict some features or compatibility with eyeinspect applications. Caution: Firmware upgrades may erase container configurations. Before proceeding with an upgrade: Review the official Cisco documentation for upgrade procedures If you are using Custom Certificates, download them from the switch's file manager to your local machine. This ensures that you can re-upload the certificates if they are deleted during the upgrade process.
Command Center Version	5.5.x
Licensing	IR1821 - Network Essentials IR1101 - Network Advantage
Additional Hardware	SSD (for larger disk allocation, optional) 24VDC power supply - Cisco provides them if necessary. (for example, PWR-IEW)
Platform	IoX (for running Docker apps)
Active Sensor ARM Docker Image	The Cisco Catalyst IR1821 and IR1101 use an ARM processor, so an ARM-compatible sensor image is required. To download the sensor image: Navigate to the Forescout Support Portal From the Base Product dropdown, select Forescout eyeInspect Expand the eyeInspect Releases and Hotfixes dropdown Find the eyeInspect Active Sensor (Docker image for ARM64) entry Click the blue downwards-facing arrow to download the image file eyeinspect_active-sensor_2.1.1_image_arm64.tar.gz to your local machine

Configure the Switch

Set Device Time and Date: It is crucial to synchronize the router's clock with the correct time zone. To do this:
1. Check the current time and date by running the following command:
```
show clock
```
2. Verify that the time and date are correct. If necessary, set the correct time and date by running the following commands:
```
enable
clock set <HH:MM:SS> <Month> <Day> <Year>
write memory
```
  Note: The clock set command is executed in privileged EXEC mode, and not in configuration mode.
Setup VirtualPortGroup Port: For Docker applications to have external access, they must:
- Be connected to a VirtualPortGroup
- Have the correct IP address assigned
  To setup VirtualPortGroup, do the following:
  1. IP Address Assignment for Docker application: The IP address 169.254.0.1 is used within the Cisco IR1821/1101 devices to support internal communication. This IP is used to manage internal device communication and, if needed, can serve as a NAT interface for external connectivity.
  2. Customizing IP Addresses:These IPs use the 169.254.x.x link-local range, common for internal-only communications. If your deployment requires a different IP range, select an alternative private IP (e.g., 10.x.x.x or 192.168.x.x) and adjust the configurations consistently across all related steps.
  3. Configure VirtualPortGroup (VPG):
```
Configure terminal
ip routing
interface virtualportgroup 0
ip address 169.254.0.1 255.255.255.252
exit
```
Setup NAT for Internet Access: NAT rules need to be added to allow the container to access external networks.
- NAT Configuration for External Network Access: To enable the sensor application to reach external networks, NAT rules are configured on a separate VirtualPortGroup interface. The key IP addresses for this setup are:
  - GigabitEthernet 0/0/0: This interface connects to the external network and is marked as IP NAT outside.
  - VirtualPortGroup 0 (169.254.0.1): This IP serves as the internal NAT interface (IP NAT inside) for managing container traffic.
- NAT Access Control List (ACL): The ACL rule 10 permit 169.254.0.0 0.0.0.3 limits NAT to the 169.254.0.x subnet, ensuring that only traffic from the VirtualPortGroup 0 interface can use NAT for external access..
- Customizing IP Addresses in NAT: If your network environment requires a different internal IP range, change the VirtualPortGroup 0 IP and modify the ACL accordingly. For example, if using a 192.168.0.1 subnet, update 169.254.0.0 to 192.168.0.1 and change the ACL to permit 192.168.0.1 0.0.0.3.
- Configure interfaces and NAT:
```
Configure terminal
interface GigabitEthernet 0/0/0
ip nat outside
exit
interface VirtualPortGroup 0
ip nat inside
exit
ip nat inside source list NAT_ACL interface GigabitEthernet 0/0/0 overload
ip access-list standard NAT_ACL
10 permit 169.254.0.0 0.0.0.3
end
write mem
```
Enable IOx on the device:
1. Enter global configuration mode by running the following command:
```
configure terminal 
```
2. Enable the IOx feature by running the following command:
```
iox
```
Check the status of the IOx service:
1. Exit global configuration mode by running the following command:
```
exit
```
2. Check the IOx service status by running the following command:
```
show iox
```

Deploy the Active Sensor

After completing the above initial configuration, proceed to deploy the active sensor via the graphical user interface (GUI).

Limitations

Slow Nmap scans: Some scan queries such as custom, OS and OT Ports could be slow because they use nmap and scan all the open ports for the given target/range.
Firmware Updates: Updating the firmware may erase container configurations. It is recommended to back up configurations before performing any firmware upgrades.
Disk Space: As containers, applications and logs consume disk space, you may need to provision additional storage as required.
NSE Scripts Update: The Active Sensor v2.1.1 does not support the update of NSE scripts.

Use Custom Certificates

To learn how to use custom certificates with this switch, go to Use Custom Certificates on the Cisco IR1821/IR1101.